6

Can one add a clause stating

Do not use this application if the terms demanded cannot be provided by law

For example, let's say one term of use states that information collected may be retained forever, which is not possible in countries subject to the GDPR. In this case, users would be required not to use the application.

2
  • Are you selling your non-GDPR-compliant program with a price in Euros?
    – nick012000
    Nov 2 '20 at 9:07
  • Am not selling anything already I just want to know the law. Nov 2 '20 at 10:34
9

Can a clause be added to a terms of use that forbids use of the service if the terms of use would be illegal in the user's jurisdiction?

Yes, but that is redundant because contracts --or portions thereof-- which contravene the law are null and void.

let's say one term of use states that information collected may be retained forever, which is not possible in countries subject to the GDPR

That premise is mistaken in contexts which involve a necessity for the performance of a contract. See recital 40 and article 6.1(b) of the GDPR. That necessity needs to be true (see recital 43) and ongoing (cf. article 17.1(a)).

Likewise, data retention might be required for compliance with a legal obligation to which the controller is subject. See articles 6.1.(c) and 17.3(b)-(e). Depending on the context, the perpetual storing of data might be justifiable under the GDPR.

Accordingly, it is not necessary for the provider to exclude natural persons merely on grounds of the GDPR.

11
  • OK.So does that mean a term stating "GDPR does not apply" will make the whole terms of service void? Nov 1 '20 at 12:35
  • 2
    @compenthusiast No. A contract does not invalidate or suppress the GDPR. That clause would be null and void. Instead, the provider needs to be able to prove [to the authorities or tribunal] that retaining the data forever is crucial for the performance contract and not just a matter of arbitrariness or bargaining power. Hence the notion of [true] necessity as contemplated in the GDPR. Nov 1 '20 at 12:44
  • So can please clarify that only that clause or the whole agreement will be invalid? Nov 1 '20 at 12:46
  • 2
    Only the clauses that contravene the GDPR or other legislation would be invalid, meaning that they will be null and void (see the first sentence in the answer). If there is no true necessity for the performance of contract, a user protected by the GDPR is entitled to exercise his right to deletion of his personal data regardless of what the clause says. Nov 1 '20 at 12:50
  • 6
    @IñakiViggers I dunno. I think that there's a difference between "clauses that violate statutory law are void and the rest of the contract stands" and "the entire contract is void if any clauses violate statutory law", especially if it's backed up by behavior on the part of the company that makes it clear that they don't intend to offer their software to individuals in areas where that isn't true. You know, something like "We knowingly violate the GDPR, so we deliberately refuse to sell our software services to European customers, so that it doesn't apply to us."
    – nick012000
    Nov 2 '20 at 11:49
15

Yes, but ...

It doesn’t protect you. Let’s imagine you put such a clause in and a person in Europe used your service notwithstanding: they’ve broken the contract but you’ve broken the law. You get the fine and they get ... nothing. Because you can’t contract outside the law you never had a valid contract with them so you have no basis to sue.

Further, because you are purporting to something you can’t legally do, you are probably on the wrong side of misleading and deceptive consumer protection law: which is another fine.

If you can ensure that you don’t breach local law - like by not operating over the internet - then you can choose not to deal with e.g. Europeans. If you can’t guarantee that, then you’re stuffed.

14
  • 3
    But can you not ask them to tell you the country they are from, and not provide the service if it's Europe? If they lie, you could not possibly have known it so you should not be responsible? Nov 2 '20 at 2:11
  • 6
    @DaleM: Nevertheless, it might give rise to a "You (the ECJ) don't have jurisdiction over me because I'm neither in the EU nor intentionally doing business with its citizens" argument. Whether that argument actually works is a different matter.
    – Kevin
    Nov 2 '20 at 4:29
  • 2
    "you’re stuffed" is probably a bit of exaggeration. If another country wants to hold you accountable for breaking one of their laws, assuming you have no legal presence there (like a subsidiary), that's a rather complex story and it seems unlikely that you'd face many, if any, consequences unless it's a particularly egregious crime. Even aside from that, I'd still be surprised if they're try to hold you accountable for GDPR despite you taking reasonable steps to ensure no-one in those countries uses the service (mentioning it in the contract may not be sufficient for this through).
    – NotThatGuy
    Nov 2 '20 at 5:10
  • 1
    GDPR.EU does give some guidelines and hints as to what would and wouldn't be allowed: "regulators look for other clues to determine whether the organization set out to offer goods and services to people in the EU" and "Suppose you run a golf course in Manitoba focused exclusively on your local area, but sometimes people in France stumble across your site. Would you find yourself in the crosshairs of European regulators? It’s not likely."
    – NotThatGuy
    Nov 2 '20 at 5:12
  • 4
    This answer looks wrong. The GDPR applies to companies doing business in or with the EU. Whether a non-EU business is included will be judged on the whole evidence, including the contract terms. Contract terms that explicitly state the offer is not valid in the EU will weigh towards the conclusion. Other factors (such as a price in euro's) can contradict it, but then those actions would be the basis for the GDPR violation, not the contract.
    – MSalters
    Nov 2 '20 at 12:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.